Cloud Workload Security

Cloud Workload Security (CWS) helps you prevent risky cloud changes. Apply policy controls to API requests before they reach your cloud provider.

Use CWS to:

• Define policies to allow approved operations and block risky requests.
• Inspect request content, including parameters and request-body fields.
• Enforce guardrails across the cloud resources your policies cover.

For example, block requests that would make an R2 bucket public. Allow requests that keep the bucket private.

You manage CWS resources in the Cloudflare dashboard. A proxy you run in your environment loads a deployment's configuration and evaluates requests routed through it.

Workloads select requests, policies check them, and policy sets group those checks for a deployment.

To understand how these entities validate requests, refer to Request Validation.

A workload is a reusable filter that selects a group of requests. For example, select Cloudflare API traffic or requests for production accounts. Include or exclude workloads in a policy set to choose where its policies apply.

A policy combines a request filter with a Rego check. Rego is the language used to write the check. Its Boolean valid rule determines whether a request passes. For example, reject a request that would make an R2 bucket public.

A policy set groups policies and defines their workload scope. Include or exclude workloads to choose which requests it covers. Each policy's own filter still applies.

Turn on Enforce for policies that should block failed checks. Attach the policy set to a deployment to apply it.

A deployment is the configuration that a proxy loads. It references policy sets and can include a domain ACL and Basic Auth credentials. Its Default mode applies when no policy matches a request. Its On error action configures policy error handling.

A CWS proxy is the process that enforces a deployment's configuration. Run it in your environment using a deployment ID and Cloudflare API credential. Route client API requests through it to apply your controls. The proxy refreshes its configuration and records request decisions.

A domain access control list (ACL) controls which destinations a deployment can reach. It uses domain-specific allow or block rules and a default action. Allowing a destination does not bypass request policies.

A Basic Auth credential identifies a client using the proxy. It has a username and uses password secrets for authentication. Workload and policy filters can match this identity.

These credentials are separate from the proxy's Cloudflare API credential and the client's cloud-provider credentials.

A secret is a password associated with a Basic Auth credential. A credential can have multiple secrets with optional expiration times. Use overlapping secrets so clients can switch passwords before the old one expires or is removed.

A Rego module stores reusable policy logic under a lib. package. Policies import its rules instead of duplicating the same checks. For example, share a private-bucket check across several policies.

Rego metadata stores shared JSON data that policies can read. Use it for settings such as whether buckets must remain private. Update the shared value without rewriting each policy.

A tenant structure describes the hierarchy of your cloud resources. Amazon Web Services (AWS) structures contain roots, organizational units, and accounts. Cloudflare structures contain organizations, accounts, and zones. Give the structure a package path to let Rego policies read its nodes.

Use workloads to apply different security profiles to different environments. For example, production accounts can require stricter policies than non-production accounts.

Create separate policy sets for production and non-production. Use workload filters to target AWS accounts or organizational units, or Cloudflare accounts or organizations.

Include the matching workload in each policy set. Attach both policy sets to the same deployment.

• Configure policies to define workloads and attach policy sets.
• Manage traffic scope to configure domain access control lists and Basic Auth credentials.
• Manage policy reference resources to reuse Rego code, metadata, and cloud hierarchies.
• Proxy configuration to choose authentication, connection, and caching settings.
• Troubleshooting to diagnose proxy, client, and policy issues.

For availability, proxy deployment options, and connection requirements, refer to Platform.